Disclosed vulnerability
Claude Code: data exfiltration via allowlisted DNS commands (CVE-2025-55284)
AIR-2025-0092 AIR record · 2025-08-claude-code-dns-exfil
From the supporting source
When reviewing or interacting with untrusted code or processing data from external systems, Claude Code can be hijacked to run bash commands that allow leaking of sensitive information without user approval.embracethered.com
The record
Disclosed
2025-08-11
Vendor
Anthropic
Product
Claude Code
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — the agent ran allowlisted DNS commands to exfiltrate
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection source code
Impact type
Data exfiltration, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude Code users before v1.0.4
Capability abused
Defense & remediation
Recorded defense
Bash tool asks for permission; ping/nslookup/dig/host were allowlisted
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
fixed 2025-06-06 in v1.0.4; Anthropic rated CVSS 7.1 High; advisory GHSA-x5gv-jw7f-j6xj
Taxonomy & references
Curator notes
Month of AI Bugs 2025. Also reported as: 'Claude Code data exfiltration via pre-approved DNS utilities (CVE-2025-55284)'.
Supporting sources
Cite as
Enkrypt AI. "Claude Code: data exfiltration via allowlisted DNS commands (CVE-2025-55284)". AIR, AIR-2025-0092. https://agentincident.vercel.app/i/AIR-2025-0092/ (accessed 2026-10-19).